System and method for virtual private network network address translation propagation over nested connections with coincident local endpoints

ABSTRACT

A communication network includes a plurality of nodes, selectively including a client, a remote gateway Internet service provider, the Internet, a local enterprise gateway, and an enterprise internal network. A local coincident endpoint is established at the local gateway for an outer connection with a remote node and an inner connection with the same or a different remote node. Nested traffic received at the gateway on the outer connection is decapsulated and then source-in NATed. Traffic received at the gateway for transmission on the outer connection is first source-in NATed, and then encapsulated for communication on the outer connection.

CROSS REFERENCES TO RELATED APPLICATIONS

[0001] U.S. patent application Ser. No. 09/______, assignee docketnumber END9 2000 0092 US1, entitled “SYSTEM AND METHOD FOR NESTINGVIRTUAL PRIVATE NETWORKING CONNECTIONS WITH COINCIDENT ENDPOINTS”, filedconcurrently herewith, and U.S. patent application Ser. No. 09/240,720filed Jan. 29, 1999 by Edward B. Boden and Franklin A. Gruber for“SYSTEM AND METHOD FOR NETWORK ADDRESS TRANSLATION INTEGRATION WITH IPSECURITY” are assigned to the same assignee hereof and contain subjectmatter related, in certain respect, to the subject matter of the presentapplication. The above-identified patent applications are incorporatedherein by reference.

BACKGROUND OF THE INVENTION

[0002] 1. Technical Field of the Invention

[0003] This invention pertains to network communications. Moreparticularly, it relates to network address translation (NAT)propagation over nested virtual private network (VPN) tunnels, orconnections, with coincident local endpoints.

[0004] 2. Background Art

[0005] An important use of virtual private networking (VPN) is to allowa remote user or small branch office to connect to an enterprise via theInternet. The basic scenario for so doing is illustrated in FIG. 1.Personal computer (PC) 10 represents a remote user, or client,connecting through an Internet Service Provider (ISP, such as SprintNet,AT&T, AOL, or the like) 12 via Internet 14 to a VPN gateway 16 (alsoreferred to as an enterprise gateway) for the enterprise. Typically inthis scenario the user at PC 10 desires to connect to some server, suchas a Lotus Notes server, within the internal network 18 of a company orenterprise. A typical configuration for doing this connection of PC 10to a server within internal network 18 uses two VPN connections (alsoreferred to as tunnels) t1 20 and t2 22. connection t1 20 begins at ISP12 and ends at gateway 16.

[0006] Connection t2 begins at PC 10, is nested within connection t1 20,then continues on to the company server internal to network 18. (By“Internet”, reference is made to a specific internet— the one usuallyreferred to today. This “Internet” is implemented by a well defined setof system routers, available from many vendors. By “internet”, referenceis usually made to any network that has its own well defined domain,routing, and other properties. These networks are usually TCP/IP based.)ISP's 12 are generally located outside of Internet 14, but not always.IBM, for example, connects directly to an AT&T ISP which is inside theInternet.

[0007] If PC 10 has a dedicated, or permanent, Internet Protocol (IP)address, this all works fine. However, it much more likely that PC 10has an IP address which is dynamically assigned by ISP 12 and which maybe, in general, from one of several designated private IP addressranges. This raises the possibility, if not likelihood, of the same IPaddress being assigned to a plurality of clients 10 seeking accessthrough gateway 16. To support such remote users 10, the company gateway16 needs some way to handle the dynamically assigned and possiblyoverlapping IP addresses assigned to these remote systems, and allow itthrough to its internal network 18.

[0008] Network address translation (NAT) is a widely-deployed approachby which an enterprise can support remote users while avoiding addresscollisions within its own internal network. However, NAT is incompatiblewith VPN for architectural reasons. U. S. patent application Ser. No.09/240,720 and other applications therein referenced, provide a solutionthat integrates NAT with VPN.

[0009] It is an object of the invention to provide an improved methodand system for managing connections within a communications system.

[0010] It is a further object of the invention to provide an improvedmethod and system for connecting a remote client to an enterprisenetwork through a local gateway.

[0011] It is a further object of the invention to provide a method andsystem for enabling an enterprise gateway to handle dynamically assignedIP addresses from remote clients.

[0012] It is a further object of the invention to provide an improvedmethod and system for supporting nested connections with coincidentendpoints.

[0013] It is a further object of the invention to provide a method andsystem for supporting automatically nested connections with coincidentendpoints (without requiring customer configuration).

[0014] It is a further object of the invention to provide a method andsystem for implementing nested connections by automatically detectingand establishing connections so as to achieve a nested implementation.

[0015] It is a further object of the invention to provide a system andmethod which extends VPN NAT to include support for nested connectionswith coincident endpoints, without requiring any special configurationfor the inner (nested) VPN connection, with respect to VPN NAT.

[0016] It is a further object of the invention to provide a method andsystem for providing, without customer configuration, tunnel ortransport mode IP security (IPsec) at a remote endpoint, with the VPNrole of the remote endpoint being host or gateway, with L2TP supportedwithin the internal connection, and with an arbitrary level ofconnection nesting.

SUMMARY OF THE INVENTION

[0017] A system and method for operating a first node in a networkincluding at least one second node. A coincident endpoint for an outerconnection and an inner connection with respect to at least one secondnode is established at the first node. Responsive to receiving a nestedpacket from the second node on the outer connection, the first nodedecapsulates the packet into a raw packet and then performs source-innetwork address translation on the raw packet. Responsive to receiving araw packet at the inner connection, the translation inverse forsource-in network address translation is performed on the raw packet,which is then encapsulated into a nested packet for communication on theouter connection to the second node.

[0018] In accordance with an aspect of the invention, there is provideda computer program product configured to be operable to perform networkaddress translation on raw packets selectively decapsulated from nestedpackets received at, or to be encapsulated for sending from, an outerconnection at a coincident endpoint of inner and outer connections in acommunications network.

[0019] Other features and advantages of this invention will becomeapparent from the following detailed description of the presentlypreferred embodiment of the invention, taken in conjunction with theaccompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0020]FIG. 1 is system and tunneling diagram illustrating a typicalclient/server connection in accordance with the prior art.

[0021]FIG. 2 is a system and tunneling diagram illustrating aclient/server connection via local coincident endpoints with VPN NATpropagation in accordance with the preferred embodiments of theinvention.

[0022]FIG. 3 is a flow diagram illustrating selected steps of thepreferred embodiment of the method of the invention.

[0023]FIG. 4 illustrates VPN NAT, type c: IDci translated forresponder-mode conversations (also known as ‘source-in’ VPN NAT). ThisFIG. 4 corresponds to FIG. 6 of U.S. patent application Ser. No.09/240,720, filed Jan. 29, 1999.

BEST MODE FOR CARRYING OUT THE INVENTION

[0024] In accordance with the preferred embodiment of the invention, asystem and method is provided for an enterprise to support remote userswhile avoiding address collisions within its own internal network.

[0025] In copending U.S. Patent application, assignee docket END9 20000092 US1, FIG. 2, scenario C illustrates the solution to definition ofclient IP addresses by using a third encapsulation on the L2TPconnection to assign routable IP address known to the enterprise(represented by enterprise gateway 16.) Referring to FIG. 2 in thepresent application, another solution, based on VPN NAT, is illustratedwhich has the advantage of not requiring a third encapsulation.Together, these form a full solution for a remote VPN user 10.

[0026] Referring to FIG. 2, client 10 may be, for example, a personalcomputer with an IP address dynamically assigned by Internet serviceprovider (ISP) 12. As noted above, the problem that a dynamicallyassigned IP address creates is that, in general, the enterprise gateway50 cannot know, a priori, about the dynamically assigned IP address.This is so because of different address domains assigned to differentISPs 12, and because ISPs 12 may assign IP addresses out of one of theranges designated for private (non-internal) use.

[0027] In accordance with the preferred embodiment of the invention, NATis performed on datagrams arriving at both outer connection t1 52 andinner connection t2 54, with the same NAT rule applied at the bothconnections without requiring special configuration of NAT on bothconnections. Further, support is provided for an arbitrary number ofnested connections, with each nested connection in either the transportor tunnel mode, and remote client 10 may be a VPN gateway in addition tobeing a VPN host. Common usage of the term “tunnel” refers to a VPNconnection, which comes in two modes: tunnel mode and transport mode. Atunnel is a VPN connection. However, in the present invention, tunnelst1 52 and t2 54 are IPsec-based VPNs, and will be, therefore, referredto as connections.

[0028] VPN NAT type ‘source-in’, as described hereafter in connectionwith FIG. 4, is applied to (configured for) outer connection t1 52. Inthis manner, the dynamic IP address of remote client 10 is translated toan enterprise internal network 18 compatible IP address when it arrivesin outer connection t1 52. When inner connection t2 54 is loaded, afterthe connection t2 outbound security association (SA) is chained to outerconnection t1 52, the chain is scanned for the last SA. Any VPN NATrules associated with the last SA are propagated to the outer-mostoutbound SA. The new outbound SA is updated with the VPN NAT rules. Thissetup is done once, during connection t2 54 load. During datagramtraffic processing, the VPN NAT rule(s) are applied to a datagram (thatis, packet) before the datagram is processed for IPsec for the innertunnel.

[0029] IP security (IPsec) is provided in a virtual private networkusing network address translation (NAT) by performing one or acombination of the three types of VPN NAT. In FIG. 4 is described thesource-in VPN NAT type used in the present invention. This involvesdynamically generating NAT rules and associating them with thedynamically generated (IKE) Security Associations, before beginning IPsecurity that uses the Security Associations. Then, as IP Sec isperformed on outbound and inbound datagrams, the NAT function is alsoperformed.

[0030] VPN NAT rules are propagated for inbound processing from outerconnection t1 52 to inner connection t2 54 dynamically rather thanstatically. After processing and inbound datagram for a outer connectiont1 52 inbound SA, if the next header is IPsec and the destination IPaddress is local, a check is made for any VPN NAT rules. If found, theyare propagated to the next inbound SA. After IPsec processing, if theresulting datagram does not have an IPsec next header, the VPN NATrule(s) are applied.

[0031] Referring to FIG. 3 in connection with FIG. 2, the method of apreferred embodiment of the invention will be described.

[0032] In step 100, customer (that is, client) 10 configures outer VPNconnection with VPN NAT.

[0033] In step 104, client 10 initiates IKE processing on outerconnection t1 52 to set up a secure inner connection t2 54.

[0034] In step 106, gateway 50 receives the first IKE packet on outerconnection t1 52 and recognizes therefrom that client 10 is initializinga nested or inner connection.

[0035] In step 108, gateway 50 obtains the client IP address(dynamically assigned previously by ISP 12) from the first IKE packet onouter connection t1 52, and saves it for future processing.

[0036] In step 110, inner connection 54 is started. In the scenarioswhich apply to the present invention, inner connections t2 54 areinitiated by client 10. More specifically, the inner connection t2 forboth this application and for copending application EN9 2000 0092 US1are initiated remotely (with respect to the gateway 50).

[0037] In step 112, or outbound SA, gateway propagates VPN NAT rule fromouter tunnel t1 52 to inner tunnel t2 54, when the inner tunnel t2 isstarted. (Steps 100-112 represent setup. Steps 114-124 which followdescribe key aspects of how packets are handled.)

[0038] In step 114, at the gateway 50, outbound packets have VPN NATapplied, are then encapsulated in the inner tunnel, then encapsulated inthe outer tunnel, and then sent on its way (out of the gateway).

[0039] In step 116, at the gateway 50, if the packet has an IPsecheader, it is decapsulated. Else, processing skips to step 124.

[0040] In step 118, if there is a VPN NAT rule for this connection, acopy of the VPN NAT rule is saved. In either case, processing continuesto step 120.

[0041] In step 120, the packet is examined to determine if more IPsecprocessing is required. That is, does the packet still have a IPsecheader? If yes, processing returns to step 116; otherwise, it continueson to step 122.

[0042] In step 122, if there is a saved VPN NAT rule, then it is appliedto the packet.

[0043] In step 124, the packet is sent on to its destination.

[0044] For both outbound and inbound traffic with respect to gateway 50(the location in this case of the coincident local endpoints), theappropriate VPN NAT rule is applied to the packet without any IPsecheader(s). So, on outbound, this is the state of the packet just beforeIPsec, and on inbound, this is the state of the packet just after IPsec.

[0045] Referring further to FIG. 2, traffic flow for outbound trafficfrom network 18 at point A is to local coincident endpoint 56 point A1on for encapsulation on inner connection t2 54; it is here NAT occurs onpackets before IPsec is applied, then encapsulated in the inner t2 54tunnel. From point A1, the packet is logically encapsulated in outerconnection at point B1, decapsulated at ISP 12 point C1, flows to innerconnection t2 54 and is finally decapsulated at client 10. Trafficflowing from client 10 to network 18 follows the reverse path, withdecapuslation and encapsulation also reversed. Encapsulation involvesadding headers to a packet, and decapsulation removes those headers.

[0046] Referring to FIG. 4, VPN NAT source-in executes to translate IDcifor responder-mode conversations as follows: in step <−2>, for remotelyinitiated conversations, at start, since NAT is requested, implicit MAPrule 158 <MAP ihs TO rhs>is created, copying responder mode NAT flagIDci 152 to rhs 154. In step <−1>, the ip address is obtained from theappropriate pool 150 (associated with IDir) and copied to lhs 156. Instep <0>, after IKE negotiation is complete using rhs 154, implicit rule160 is loaded. When processing inbound packets, if in step <1>src ip 172matches rhs 168, in step <2>source ip 172 is translated to lhs 166. Whenprocessing outbound datagrams, if in step <3>destination 164 matches lhs166, in step <4>destination ip 164 is translated to rhs 168.

[0047] In accordance with the preferred embodiments of the invention,for traffic outbound at gateway 50, inner connection (sometimes referredto as a tunnel) t2 54 inherits the VPN NAT of outer connection t1 52.Enterprise gateway 50, or wherever the coincident endpoint may be(coincident endpoint 56 is shown at gateway 50) does not initiate theconnection t1/t2, but rather this is done remotely, in the example ofFIG. 2, from client 10 and ISP 12. During setup of inner connection t254, during IKE negotiation first packet, gateway 50 kernel obtains theIP address of client 10— and this is referred to as source inboundNATing. That is, gateway 50 kernel NATs the source IP address that camein outer connection t1 52, which does address translation on the sourceIP address of the IKE traffic before the inner connection t2 54 isestablished.

[0048] For inbound traffic, after connection t1 52 is started however,because connection t2 54 is not chained to connection t1 52, afterdecapsulation of the inbound packet at point B1, gateway 50 checks tosee if the packet is encapsulated inside yet another connection. If so,gateway 50 remembers the VPN NAT rule, decapsulates it out at A1, andthen does source-in NAT according to the rule.

[0049] For outbound traffic, when a packet goes into inner connection t254 at point A1, gateway 50 applys NAT to the packet before any Ipsec isapplied. Thus, NATing is done at the coincident endpoint of theinnermost connection t2 54 for either inbound or outbound traffic.

[0050] Applying VPN NAT to a packet can occur with any depth of nestedconnections, with inner connections inheriting the NAT rules of outerconnections. One NAT rule is placed on the outermost connection t1 52,and all nested connections inherit the NAT rule from that outerconnection. Thus, client 10 controls the NAT pool, and the NATing atgateway 50 (LCE 56 point A1) is done to the values provided by client 10on outer connection t1 t2. The size of the client NAT pool determineshow many users may access network 18 through connection t1 52concurrently.

[0051] In accordance with further embodiments of the invention VPN NATmay be broadened to include other forms of tunneling NAT, such as PPPand UDP.

Advantages Over the Prior Art

[0052] It is an advantage of the invention that there is provided animproved method and system for managing connections within acommunications system.

[0053] It is a further advantage of the invention that there is providedan improved method and system for connecting a remote client to anenterprise network through a local gateway.

[0054] It is a further advantage of the invention that there is provideda method and system for enabling an enterprise gateway to handledynamically assigned IP addresses from remote clients.

[0055] It is a further advantage of the invention that there is providedan improved method and system for supporting nested connections withcoincident endpoints.

[0056] It is a further advantage of the invention that there is provideda method and system for supporting nested connections with coincidentendpoints without requiring customer configuration.

[0057] It is a further advantage of the invention that there is provideda method and system for implementing nested connections by automaticallydetecting and establishing connections so as to achieve a nestedimplementation.

[0058] It is a further advantage of the invention that a gateway is ableto support multiple concurrent VPN connections from multiple remoteISP's and the clients connecting through those ISP's may have non-uniqueIP addresses.

[0059] It is a further advantage of the invention that there is provideda system and method which extends VPN NAT to include support for nestedconnections with coincident endpoints.

[0060] It is a further advantage of the invention that there is provideda method and system for providing, without customer configuration,tunnel or transport mode IP security (IPsec) at a remote endpoint, withthe VPN role of the remote endpoint being host or gateway, and with anarbitrary level of tunnel nesting.

Alternative Embodiments

[0061] It will be appreciated that, although specific embodiments of theinvention have been described herein for purposes of illustration,various modifications may be made without departing from the spirit andscope of the invention. In particular, it is within the scope of theinvention to provide a computer program product or program element, or aprogram storage or memory device such as a solid or fluid transmissionmedium, magnetic or optical wire, tape or disc, or the like, for storingsignals readable by a machine, for controlling the operation of acomputer according to the method of the invention and/or to structureits components in accordance with the system of the invention.

[0062] Further, each step of the method may be executed on any generalcomputer, such as an IBM System 390, AS/400, PC or the like and pursuantto one or more, or a part of one or more, program elements, modules orobjects generated from any programming language, such as C++, Java,Pl/1, Fortran or the like. And still further, each said step, or a fileor object or the like implementing each said step, may be executed byspecial purpose hardware or a circuit module designed for that purpose.

[0063] While the invention has been described rather specifically to anInternet environment using current technologies (today's Internet isbuilt on IPv4), it applies to any existing or future Internet technologythat employs IKE or the equivalent to negotiate VPN, such as IPv6, whichis described in RFC 2460.

[0064] Accordingly, the scope of protection of this invention is limitedonly by the following claims and their equivalents.

We claim:
 1. Method for operating a first node in a network including atleast one second node, comprising the steps of: establishing at saidfirst node a coincident endpoint for an outer connection and an innerconnection with respect to at least one second node; responsive toreceiving a nested packet from said second node on said outerconnection, decapsulating said packet into a first packet and thenperforming source-in network address translation on said first packet;and responsive to receiving a second packet at said inner connection,performing source-in network address translation on said second packet,and then encapsulating said second packet into a nested packet forcommunication on said outer connection to said second node.
 2. Themethod of claim 1 wherein said first node comprises an enterprisegateway and said first node a remote client.
 3. Method for managingconnections within a communications system, comprising the steps of:configuring an outer connection; communicating from a client to agateway on said outer connection a request to configure a secure innerconnection; responsive to said request, initializing said gateway toreceive a future nested communication, including obtaining a clientaddress from a packet on said outer connection; starting said innerconnection; responsive to starting said inner connection, propagating anetwork address translation rule from said outer connection to saidinner connection.
 4. The method of claim 3, further comprising the stepof: further responsive to starting said inner connection, encapsulatinga packet outbound from said gateway first in said inner connection andthen in said outer connection.
 5. The method of claim 4, furthercomprising the steps of: responsive to receiving a packet at saidgateway, determining if said packet has a security header; responsive tosaid packet having said security header, decapsulating said packet andsaving any address translation rule included within said packet; andapplying said address translation rule to said packet and thereaftercommunicating said packet from said gateway to said client.
 6. Themethod of claim 5, further comprising the steps of: iterativelyexecuting said decapsulating step until a resulting decapsulated packetno longer contains a security header.
 7. Method for enabling a localgateway to handle dynamically assigned IP addresses from remote clients,comprising the steps of: assigning said IP address to a remote client;automatically maintaining between said remote client and said gatewaynested connections with local coincident endpoints.
 8. The method ofclaim 7, wherein said nested connections comprise an inner connectionand an outer connection.
 9. The method of claim 8, further comprisingthe steps of: responsive to receiving a nested packet from said clienton said outer connection, decapsulating said packet into a first packetand then performing source-in network address translation on said firstpacket; and responsive to receiving a second packet at said innerconnection, performing source-in network address translation on saidsecond packet, and then encapsulating said second packet into a nestedpacket for communication on said outer connection to client.
 10. Systemfor operating a first node in a network including at least one secondnode, comprising: an inner connection; an outer connection; a localcoincident endpoint for said outer connection and said inner connectionat said first node with respect to at least one second node; said firstnode being responsive to receiving a nested packet from said second nodeon said outer connection for decapsulating said packet into a firstpacket and then performing source-in network address translation on saidfirst packet; and said first node being further responsive to receivinga second packet at said inner connection for performing source-innetwork address translation on said second packet, and thenencapsulating said second packet into a nested packet for communicationon said outer connection to said second node.
 11. Method for extendingvirtual private network (VPN) network address translation (NAT) toinclude support for nested connections with coincident endpoints,without requiring any special configuration for the inner (nested) VPNconnection, with respect to VPN NAT, comprising the steps of:configuring an outer connection with a VPN NAT rule; communicating froma client to a gateway on said outer connection a dynamically generatedsecurity association request packet to configure a secure innerconnection; responsive to said request, initializing said gateway toreceive a future nested communication, including obtaining a clientaddress from said request packet on said outer connection; starting saidinner connection; responsive to starting said inner connection,propagating said VPN NAT rule from said outer connection to said innerconnection.
 12. The method of claim 11, further comprising the step of:further responsive to starting said inner connection, encapsulating apacket outbound from said gateway first in said inner connection andthen in said outer connection.
 13. The method of claim 12, furthercomprising the steps of: responsive to receiving a packet at saidgateway, determining if said packet has a security header; responsive tosaid packet having said security header, decapsulating said packet andsaving any VPN NAT rule included within said packet; and applying saidNAT rule to said packet and thereafter communicating said packet fromsaid gateway to said client.
 14. The method of claim 13, furthercomprising the step of: iteratively executing said decapsulating stepuntil a resulting decapsulated packet no longer contains a securityheader.
 15. The method of claim 13, further comprising the step of:supporting L2TP within said internal connection.
 16. System forextending virtual private network (VPN) network address translation(NAT) to include support for nested connections with coincidentendpoints, without requiring any special configuration for the inner(nested) VPN connection, with respect to VPN NAT, comprising: a gateway;a client; an inner connection for connecting said gateway and saidclient; an outer connection for connecting said gateway and said client;said outer connection being configured by said client with a VPN NATrule; said outer connection for communicating from said client to saidgateway a dynamically generated security association request packet toconfigure said inner connection; said gateway further responsive to saidrequest for initializing said gateway to receive a future nestedcommunication, including obtaining a client address from said requestpacket on said outer connection; said gateway further responsive tostarting said inner connection for propagating said VPN NAT rule fromsaid outer connection to said inner connection.
 17. A program storagedevice readable by a machine, tangibly embodying a program ofinstructions executable by a machine to perform method steps foroperating a first node in a network including at least one second node,said method steps comprising: establishing at said first node acoincident endpoint for an outer connection and an inner connection withrespect to at least one second node; responsive to receiving a nestedpacket from said second node on said outer connection, decapsulatingsaid packet into a first packet and then performing source-in networkaddress translation on said first packet; and responsive to receiving asecond packet at said inner connection, performing source-in networkaddress translation on said second packet, and then encapsulating saidsecond packet into a nested packet for communication on said outerconnection to said second node.
 18. A computer program product orcomputer program element for operating a first node in a networkincluding at least one second node according to the steps of:establishing at said first node a coincident endpoint for an outerconnection and an inner connection with respect to at least one secondnode; responsive to receiving a nested packet from said second node onsaid outer connection, decapsulating said packet into a first packet andthen performing source-in network address translation on said firstpacket; and responsive to receiving a second packet at said innerconnection, performing source-in network address translation on saidsecond packet, and then encapsulating said second packet into a nestedpacket for communication on said outer connection to said second node.19. A program storage device readable by a machine, tangibly embodying aprogram of instructions executable by a machine to perform method stepsfor managing connections within a communications system, said methodsteps comprising: configuring an outer connection; communicating from aclient to a gateway on said outer connection a request to configure asecure inner connection; responsive to said request, initializing saidgateway to receive a future nested communication, including obtaining aclient address from a packet on said outer connection; starting saidinner connection; responsive to starting said inner connection,propagating a network address translation rule from said outerconnection to said inner connection.
 20. The storage device of claim 19,said method steps further comprising the step of: further responsive tostarting said inner connection, encapsulating a packet outbound fromsaid gateway first in said inner connection and then in said outerconnection.
 21. The storage device of claim 20, said method stepsfurther comprising the steps of: responsive to receiving a packet atsaid gateway, determining if said packet has a security header;responsive to said packet having said security header, decapsulatingsaid packet and saving any address translation rule included within saidpacket; and applying said address translation rule to said packet andthereafter communicating said packet from said gateway to said client.22. The storage device of 21, said method steps further comprising thesteps of: iteratively executing said decapsulating step until aresulting decapsulated packet no longer contains a security header.